EUVD-2026-82468Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated remote sign-up against defaults gives AV:N/AC:L/PR:N/UI:N; only low-privilege account creation with no proxy-data access yields C:N/I:L/A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the user role without administrator approval. The user role cannot view or modify proxy data, so the direct impact is limited to unauthorized creation of low-privilege accounts. The fixed configuration in src/lib/config.ts and src/lib/auth-server.ts requires AUTH_ALLOW_SELF_REGISTRATION=true before the authentication library's disableSignUp control permits sign-up. This issue is fixed in version 1.5.1.
AnalysisAI
Caddy Proxy Manager releases prior to 1.5.1 ship with email/password self-registration enabled by default at /api/auth/sign-up/email, so unauthenticated remote attackers can create an active account without any administrator approval step (CVSS 5.3, AV:N/AC:L/PR:N/UI:N). The resulting account is assigned only the low-privilege 'user' role, which cannot view or modify proxy configurations or certificates, so the practical impact is limited to unauthorized account creation and a potential foothold rather than administrative compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the Caddy Proxy Manager instance be running a version prior to 1.5.1 in its default configuration, where email/password self-registration at /api/auth/sign-up/email is enabled with no administrator approval step. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-severity issue despite being remotely and trivially reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Caddy Proxy Manager 1.5.1 or later, which is the vendor-released patch; the fixed build is published at https://github.com/fuomag9/caddy-proxy-manager/releases/tag/v1.5.1 and the change is captured in commit ed6d04f0d80a9c4c234e83e11af6fe635ce117cc, with full details in advisory GHSA-4wcc-gwxr-gc9p. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today